iOS9 ATS: what about HTML5 based apps?

cordova https sencha-touch ios9
Dennis picture Dennis · Jun 10, 2015 · Viewed 11.7k times · Source

According to the documentation from https://developer.apple.com/library/content/releasenotes/General/WhatsNewIniOS/Articles/iOS9.html#//apple_ref/doc/uid/TP40016198-SW14, Apple forces to use HTTPS over HTTP in iOS 9.

App Transport Security

App Transport Security (ATS) lets an app add a declaration to its Info.plist file that specifies the domains with which it needs secure communication. ATS prevents accidental disclosure, provides secure default behavior, and is easy to adopt. You should adopt ATS as soon as possible, regardless of whether you’re creating a new app or updating an existing one.

If you’re developing a new app, you should use HTTPS exclusively. If you have an existing app, you should use HTTPS as much as you can right now, and create a plan for migrating the rest of your app as soon as possible.

What does that mean for web applications, esp. Sencha Touch and Cordova/PhoneGap based ones? My web app can be configured to any server address, so there's no way I can whitelist them in a plist file. Will this only be applicable for applications that use native requests (via NSURLRequest etc.)?

Answer

robert.little picture robert.little · Sep 17, 2015

Try this: cordova plugin add https://github.com/robertklein/cordova-ios-security.git

It will add the following part to the *-Info.plist file during build process:

<key>NSAppTransportSecurity</key> 
<dict>
  <key>NSAllowsArbitraryLoads</key> <true/> 
</dict>

Related questions

Get rid of SSL verification in Cordova in app browser

I am building a web and hybrid mobile app. The apps communicate with third party service using ssl self-sign cert in staging env. Desktop browsers allow to accept invalid cert with risk warning but in iOS app I got this …

Read More
Phonegap/Cordova whitelisted cross domain SSL request not working after exporting APK

I have created a phonegap app which needs to communicate with a self signed SSL service. I whitelisted my url in res/xml/cordova.xml like so: <access origin="https://www.mydomain.com" subdomains="true" /> and this works …

Read More
Error: ANDROID_HOME is not set and "android" command not in your PATH. You must fulfill at least one of these conditions.

I'm trying to install PhoneGap and I'm getting the following error: Error: ANDROID_HOME is not set and "android" command not in your PATH. You must fulfill at least one of these conditions. Error (screenshot) What do I do to …

Read More